Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 23:04
Behavioral task
behavioral1
Sample
6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe
- Size 560KB
- Sample260920-22rr7a1ejf
- SHA256 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163
- MD5 7438555b90b2a95963b28a8306cf7ad5
- SHA1 293226ccbb90b11152cee460073b0c76d3f10cfa
- SHA512 4b7dbda5055555ba0130b7350e5e06562b595c52f326e59b28dbef7f6fb87212b923f15008e306b6fec3c19a8b95515e90bc551e940effca57f73243dd396f91
- SSDEEP 6144:ZUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:ZYsVOdhElvkCgvDLe4usOkxHy
- TLSH T1F2C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4908 d9da0f50 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 7 223.5.5.5 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 40 114.114.114.114 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 105 114.114.114.114 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 107 223.5.5.5 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 162 114.114.114.114 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 3 114.114.114.114 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 41 114.114.114.114 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 42 223.5.5.5 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 45 223.5.5.5 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Destination IP 163 223.5.5.5 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d9da0f50 File created C:\Windows\SysWOW64\d9da0f50 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d9da0f50 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d9da0f50 -
resource yara_rule behavioral2/memory/5696-0-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000e00000001b319-2.dat upx behavioral2/memory/4908-4-0x0000000000DC0000-0x0000000000E4C000-memory.dmp upx behavioral2/memory/5696-16-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/4908-17-0x0000000000DC0000-0x0000000000E4C000-memory.dmp upx behavioral2/memory/4908-34-0x0000000000DC0000-0x0000000000E4C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5406d8 d9da0f50 File opened for modification C:\Windows\618480 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9da0f50 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d9da0f50 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d9da0f50 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d9da0f50 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d9da0f50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d9da0f50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d9da0f50 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d9da0f50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d9da0f50 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d9da0f50 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4908 d9da0f50 4908 d9da0f50 4908 d9da0f50 4908 d9da0f50 4908 d9da0f50 4908 d9da0f50 4908 d9da0f50 4908 d9da0f50 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Token: SeTcbPrivilege 5696 6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe Token: SeDebugPrivilege 4908 d9da0f50 Token: SeTcbPrivilege 4908 d9da0f50
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe"C:\Users\Admin\AppData\Local\Temp\6e24e50bde0aececd38b3115c9579390c7e53c77e3e9fc7380ac38ea547f7163.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696
-
C:\Windows\Syswow64\d9da0f50C:\Windows\Syswow64\d9da0f501⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d9da0f50
- Size 560KB
- SHA256 61b2e9598be0f57d78df44be1571f438447b131b537c060504db5bc723cbb797
- MD5 3a93c8af9e4a2b7fcfc21260a8cdcfb3
- SHA1 20f403ee6af4f954cb22718bb8db656957b0d5cd
- SHA512 a6c16b0df311d51a04f9a3a1c0b4cf59019747217d9b668fd15f93741d45d2fabc79e5f84bede7e95fe1f1baaab4e3cb06471022c8c9fda07d1a300760e0d1d2
- SSDEEP 6144:0UJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:0YsVOdhElvkCgvDLe4usOkxHy
- TLSH T134C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH